Blog

Notes on x402, agent payments, and screening transactions before they happen.

• July 31, 2026

  The median MCP server installs 94 packages, and 88% pull an HTTP framework into a stdio process

  I built an MCP server and measured what installing it costs: 95 packages, including express and hono, for a process that only speaks over stdin and stdout. Then I measured all 6,139 npm-packaged stdio servers in the official registry. The median is 94 — and 95 for a server on the v1 SDK, which is exactly where mine landed. Almost none of that is chosen by the people who wrote these servers, and almost none of it is visible in what they declared. Here is the data, two bugs I found in my own measuring code, and what the new SDK v2 changes.

• July 26, 2026

  A changed payTo address is not a honeypot: 272 payTo changes, 13 lookalikes, zero proof

  I built a detector that flagged x402 endpoints for changing their payment address and pointed it at the public Bazaar for a month. It labeled Tavily and Browserbase high-risk. Every one of its 272 flags failed to support that label — including the 13 that had the exact shape of an address-poisoning attack. Here is the data, the five separate ways the detector was wrong, and what I changed.

• June 21, 2026

  Five ways an x402 payment can go wrong — and which ones you can catch before your agent pays

  A threat model for x402 agent payments: which attacks you can catch locally, before paying, in your own code — and which fundamentally need reputation data. With the actual check logic.